1aa44fcf5a2d988d0e100ae2c90cdcb10f117e6794fc514ef28fffc05652adb7

Analysis

max time kernel
178s
max time network
187s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01/08/2024, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

81cae85eda4f7551fec7111e1b4e2144_JaffaCakes118.apk
Size

10.5MB
MD5

81cae85eda4f7551fec7111e1b4e2144
SHA1

65f2a27305c3c9da3e882af6139d5bc6725c83b2
SHA256

1aa44fcf5a2d988d0e100ae2c90cdcb10f117e6794fc514ef28fffc05652adb7
SHA512

aa55e92e11862f695a962c862c322a1ae998429ff55c497f07e451d9558ea6be68affbca7658c535e0157cdc8eb170daf72d514f9c629ff05cd2d154a63d00f7
SSDEEP

196608:QLEmFKJAI0nEl5I1u6rw2WPeneUxeJwedO/C4u7UCkM/maN+6L/706dR9tRGCkp4:QLDnEl5I1u6rZnd00C42/LT0sRiw

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.sogou.androidtool:remote_proxy
/sbin/su	com.sogou.androidtool:push_service
/system/app/Superuser.apk	com.sogou.androidtool:push_service
/sbin/su	/system/bin/sh -c type su
/sbin/su	com.sogou.androidtool:remote_proxy
/system/app/Superuser.apk	com.sogou.androidtool:remote_proxy
/sbin/su	/system/bin/sh -c type su
/sbin/su	com.sogou.androidtool

Queries information about running processes on the device 1 TTPs 6 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sogou.androidtool
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sogou.androidtool:remote_proxy
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sogou.androidtool:push_service
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sogou.androidtool:channel
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sogou.androidtool:remote_proxy
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sogou.androidtool:channel

Requests cell location 2 TTPs 4 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.sogou.androidtool:remote_proxy
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.sogou.androidtool
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.sogou.androidtool:remote_proxy
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.sogou.androidtool:push_service

Queries information about active data network 1 TTPs 4 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sogou.androidtool
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sogou.androidtool:remote_proxy
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sogou.androidtool:push_service
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sogou.androidtool:remote_proxy

Queries information about the current Wi-Fi connection 1 TTPs 4 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.sogou.androidtool:push_service
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.sogou.androidtool:remote_proxy
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.sogou.androidtool
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.sogou.androidtool:remote_proxy

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.sogou.androidtool
Framework service call	android.app.IActivityManager.registerReceiver	com.sogou.androidtool:push_service
Framework service call	android.app.IActivityManager.registerReceiver	com.sogou.androidtool:remote_proxy

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.sogou.androidtool:remote_proxy
Framework API call	javax.crypto.Cipher.doFinal	com.sogou.androidtool:push_service

Checks memory information 2 TTPs 2 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sogou.androidtool:push_service
File opened for read	/proc/meminfo	com.sogou.androidtool:remote_proxy

com.sogou.androidtool
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4304
- chmod 777 /data/user/0/com.sogou.androidtool/cache
  2⤵
  PID:4334
- chmod 777 /data/user/0/com.sogou.androidtool/cache
  2⤵
  PID:4357
- chmod 777 /data/user/0/com.sogou.androidtool/cache
  2⤵
  PID:4388

com.sogou.androidtool:remote_proxy
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4542
- chmod 777 /data/user/0/com.sogou.androidtool/cache
  2⤵
  PID:4683

com.sogou.androidtool:push_service
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4742
- chmod 777 /data/user/0/com.sogou.androidtool/cache
  2⤵
  PID:4778
- /system/bin/sh -c getprop ro.board.platform
  2⤵
  PID:4894
- getprop ro.board.platform
  2⤵
  PID:4894
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4919

com.sogou.androidtool:channel
1⤵
- Queries information about running processes on the device
PID:4942

com.sogou.androidtool:remote_proxy
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5004
- chmod 777 /data/user/0/com.sogou.androidtool/cache
  2⤵
  PID:5032
- getprop ro.build.version.emui
  2⤵
  PID:5094
- getprop ro.build.version.opporom
  2⤵
  PID:5133
- getprop ro.smartisan.version
  2⤵
  PID:5177
- /system/bin/sh -c getprop ro.board.platform
  2⤵
  PID:5201
- getprop ro.board.platform
  2⤵
  PID:5201
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:5227

com.sogou.androidtool:channel
1⤵
- Queries information about running processes on the device
PID:5391

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sogou.androidtool/databases/MessageStore.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.sogou.androidtool/databases/MessageStore.db-journal

Filesize
512B

MD5
625c915f9aac127866a8f7fbeffc90d3

SHA1
7b6be39e5c6366c01e4f0b2cfc2a878a9e634c51

SHA256
d0eca93f6bc7534a8dd1dfe35646a935c0c46d94957da172177fb69cc0816d2c

SHA512
67baa8b9c18f4d211d058774e9f10634ef980adbabced9c79c9f3c45d106e898fbb7e0b4032415168e9c58afcf6da40b8e92240c6c5f676be3a22fa59827cafd

Download Submit
/data/data/com.sogou.androidtool/databases/MessageStore.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.sogou.androidtool/databases/MessageStore.db-wal

Filesize
48KB

MD5
538750a2102824234a7e75eaa5a6c9f7

SHA1
fba850795c15226f6b50604b9f2e4bc9ae489ff6

SHA256
575bcdde7ff2286418f74757832e302f5cfa2480920c63fc0e746b526164e9ef

SHA512
06ec41624974ab49d4f06b23ec0c0a6fe3fd47f3ba237c614b3ba159c7445d1f513df29440139a32a01869a88fb78e10868cc3bf403f05d5529300eebb73ba03

Download Submit
/data/data/com.sogou.androidtool/databases/MsgLogStore.db-journal

Filesize
512B

MD5
c8d68b9376b7cbdea66f98b55d9aba79

SHA1
e87e4050b7228e8e7ebcf64d346f819c790d3a85

SHA256
4103d7c45381b63f4ae72d2cb6781e2fb2fc5d768f6cb428223e81ed7ad96c43

SHA512
6b0ce17744fe8f664943f130f3adbf851c79c6acad3ec78203f42cfd5b15a389a72e5bc9f0d695ba0cb11083a8ae92b1ffa566a0e3e67038e3a0f1747e169dff

Download Submit
/data/data/com.sogou.androidtool/databases/MsgLogStore.db-shm

Filesize
28KB

MD5
f9083955efd8af73db7a73c3fe7229a9

SHA1
f3ed1d8e6062516b47b54ea1877421d4454af206

SHA256
358f8f88e78721ca3a583261976b4553e1fdb88a82d6ead4f3eeb70c30d3bc23

SHA512
ee5e2904174112441ea91e1a111f6704f91125630784b5a97d94b4e04d3c898bae46bfb3034c0e2e1f33e4f2871718ed402ae03fb28c373b85191821e53db98a

Download Submit
/data/data/com.sogou.androidtool/databases/MsgLogStore.db-wal

Filesize
68KB

MD5
544523192dc706978fc691b3188e9343

SHA1
6a0e25b9faf2c69add30f5ab14c106e46ca0120e

SHA256
573344c10119acbb7b071fa11e781833aef94eaad220302fcd3fd988c477ac3d

SHA512
6b2222ca90dd3351f31bc2fc46c778da5f43301cec27e13adc2efb8bdf4e4d7047af9fb5f8493c7688485e9f23d3f46388e8bbd0bb2612cd2314dc7ba964f9df

Download Submit
/data/data/com.sogou.androidtool/databases/bugly_db_

Filesize
4KB

MD5
87f154dccb8e433479d3fb75d92d6823

SHA1
18420ed80b194fc987f9c1e4469d0576b1c7eebf

SHA256
c7c8ca541ff5ac3e3b16c685821e208292c1f56b76cb5b6400b34bf3a8b565a2

SHA512
03776f3596efb7297c6e13cddf52045641c4e39beb46488c70a0c2cccdca87997b2f93a27bd2f3882c80389228fdc2f8ade6e3de64f097cb7c3acf89acd4db6e

Download Submit
/data/data/com.sogou.androidtool/databases/bugly_db_-journal

Filesize
512B

MD5
5dfa33c7e8faaa64988c488aae1667e0

SHA1
8d5b840f55716bdf9597d166a607d10201ea9b2c

SHA256
08fcb32ffa1442f3a5da8c563a1c3eeaf8fd40ee3122fb1c3b072999ac0fbc4e

SHA512
e6da45a8e5e736df14da46e2da2db24b4cbcc058eadad81ff2090cfa3c477aab83a5a43b884839dfcf5fc84c01f26d842f30d3f304200af02eef60dd25c208c7

Download Submit
/data/data/com.sogou.androidtool/databases/bugly_db_-wal

Filesize
88KB

MD5
7d7d36349539288c51db08af9ffc86da

SHA1
fd1a7e035a90c359d135cbae4eb5bb86174e1101

SHA256
018f3c3046410ca9ffa216165bb5e068681c6ff616a9d5f488a36ab7769d2229

SHA512
459fa87a01b2540f92793b495c39890c78b5f0770108cd00a675ac97ab4f33701d9ec28d70624ed4f67c7aec0fb8051f2388d1120efa7bb445beb36e177ef111

Download Submit
/data/data/com.sogou.androidtool/databases/downloads_classic.db-journal

Filesize
237KB

MD5
64a2450766768ee6dd45b0848379a300

SHA1
eac2d3544becaa9951ba3c1c17ebd4995a17be9e

SHA256
62f622f1643bbfce32a89fcfef5c2f2dd64a5ce9d98fd1cdce9c4273655a607b

SHA512
4bd06f47c3c38aa90ae5ffd7d3bbf5f7ee907b4cc9a470363230e99c08f81c4c830282ec1865e8bb0d7758eafb7e4def56a1ff7946166564932025ba2202c249

Download Submit
/data/data/com.sogou.androidtool/databases/downloads_classic.db-wal

Filesize
40KB

MD5
389493d3afd35627458fbb2252363166

SHA1
ca8d33e1d28c2a3d09017dbab264865ede0008cf

SHA256
5199a08b06e19f5565616cfd0f3c221919b8da1937ca50e5b1ea5aab0f868b9a

SHA512
1729780e3fed58161788242f0b5826869ad9b3f35cf4a7abf3eeef5f832f806f641001be3f9543e3c1c60f93a863736ed6a62cef78f28bb0008f2234cd782e3d

Download Submit
/data/data/com.sogou.androidtool/databases/pb_db

Filesize
20KB

MD5
650956f5790780ebe873a98ec3c6208e

SHA1
93d153640b298e9214eca32825ec30b181f9e8ce

SHA256
36b4a521ca7add4a85d3ceffd27777e37c0c0e06c44977492e58657664d59cab

SHA512
9fcc0dd8a702424908286f597c6418516a939038d264c2d31f65dc48fc5b025d7a4c85d85a54dbaf33708b7ccb0c703c2bb0762033a6fcfe7917287c6d307449

Download Submit
/data/data/com.sogou.androidtool/databases/pb_db-journal

Filesize
512B

MD5
fd2cffa3e5f16bfecbbfaf2e223edcc7

SHA1
3624bf5f27b1bd26b5eb161888b164ae457bec7b

SHA256
e95be3f13465952f45ea9630185bf2723e7b0399ed35f430edffc942d3fa243f

SHA512
00d4de2c0189dc640a5be9eed07355361f49a9c0108bbead94761fca2c890aff871095a94a94d97e39268c2922c88f886762c61a6b2abf9fa30797ec2432a52a

Download Submit
/data/data/com.sogou.androidtool/databases/pb_db-wal

Filesize
32KB

MD5
380def641fba0a167531c4b1072579b3

SHA1
db9a59d38194b3cd6c1fc47c0d95a4b9013c1640

SHA256
c294275dcb028dce2aae85155cf3d41a1744767a425da7b798c7d081fe0e6088

SHA512
2868de1c8bf33d51577a861833cefa40bffa496b3d0c820435aacde1d8366257c6a745dcdae8cd495070d0ffe966cade06d419cce24328b55dcbe97acd409e26

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads